Skip to content

Obfuscated Files or Information

Technique · ATTACK:enterprise:T1027

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027",
  "title": "Obfuscated Files or Information",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1027",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
  "external_id": "T1027",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:32.662Z",
  "modified": "2026-09-11T19:32:58.098Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Volexity PowerDuke November 2016",
      "url": "https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"
    },
    {
      "source_name": "FireEye Obfuscation June 2017",
      "url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
    },
    {
      "source_name": "FireEye Revoke-Obfuscation July 2017",
      "url": "https://www.blackhat.com/docs/us-17/thursday/us-17-Bohannon-Revoke-Obfuscation-PowerShell-Obfuscation-Detection-And%20Evasion-Using-Science-wp.pdf"
    },
    {
      "source_name": "Linux/Cdorked.A We Live Security Analysis",
      "url": "https://www.welivesecurity.com/2013/04/26/linuxcdorked-new-apache-backdoor-in-the-wild-serves-blackhole/"
    },
    {
      "source_name": "Carbon Black Obfuscation Sept 2016",
      "url": "https://www.carbonblack.com/2016/09/23/security-advisory-variants-well-known-adware-families-discovered-include-sophisticated-obfuscation-techniques-previously-associated-nation-state-attacks/"
    },
    {
      "source_name": "PaloAlto EncodedCommand March 2017",
      "url": "https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/"
    }
  ]
}

Explicit source assertions (187)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--015b902b-4370-4b55-884a-a6c8d2b15687

Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Wiz Shai-Hulud September 2025 · Socket Shai-Hulud November 2025 · Socket Shai-Hulud Trufflehog September 2025

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--034b1ca2-8202-4eb9-9fbe-b519ed3dd5a8

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--051683e6-0a6a-4a40-bf5d-d2c5f25586e8

Microsoft Sliver 2022

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06f16826-1100-4958-86e3-784a22998060

CrowdStrike Wizard Spider October 2020

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06fbdb2f-97d5-4140-9300-0a1f6ab72cb2

therecord_redcurl · group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurl

ATTACK:enterprise:T1027.005 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a7810c5-850a-41e9-9d44-cbbdeebd8044

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b58e2e5-9be5-4132-a65f-19db8acd7033

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dd73de5-d615-4455-a552-ff382ec75e82

Infoblox Lokibot January 2019

ATTACK:enterprise:T1027.009 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ec0af54-0182-4ad4-9b0e-4542a822de7f

ATTACK:enterprise:T1027.013 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fee6145-185d-417f-a431-201a5b3e3259

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1098fd1c-b615-4730-bc99-3cda386f2e4c

HP SVCReady Jun 2022

ATTACK:enterprise:S0393 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11ea144c-253e-4f68-bb2c-1f942cba6b54

ESET Turla PowerShell May 2019

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--130768d0-0f98-4a1b-b4bb-34c5e372cda1

Picus Security BRICKSTORM UNC5221 October 2025 · Google BRICKSTORM September 2025

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--142ef662-460f-4082-8f76-f08dd312bc30

SecureList SynAck Doppelgänging May 2018 · Kaspersky Lab SynAck May 2018

ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1793516c-a4dd-4726-9bb3-c3b2bbecc605

BlackBerry Amadey 2020

ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--194d773b-a9b6-43fc-8113-8e120be95c5c

ESET Dukes October 2019

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1970d1b3-ed23-44b5-a83f-d6a952714144

Volexity 3CX Supply Chain Compromise AppleJeus IconicStealer March 2023 · Mandiant 3cx UNC4736 2023

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a1fd6b3-bc40-4646-958a-34c35d1b0451

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S9033 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bf7899f-98c1-4600-a15a-4e77880c21ee

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S0197 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f8be617-c842-4828-a352-9d5eafb8f477

FireEye Fin8 May 2016

ATTACK:enterprise:S0593 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ffbf752-ed3a-47bb-8351-92ed7118dc5d

CISA EB Aug 2020

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20196489-8426-4cb7-a8f0-ca51bef7a385

NSA/FBI Drovorub August 2020

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25b8b66a-a9d0-4400-8b41-dd12208a25de

Unit 42 Valak July 2020 · SentinelOne Valak June 2020 · Cybereason Valak May 2020

ATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26402760-e6cb-47b7-aabc-8271549e5f22

DCSO StrelaStealer 2022 · IBM StrelaStealer 2024

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--277971c7-d42e-497f-8df4-be5b4bc094f8

Anomali Rocke March 2019

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27f8b192-9e86-49dc-abca-5bda3f8f7e89

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0594 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28c56887-5dbb-4269-b783-8a7f8d4c9204

Trend Micro Muddy Water March 2021

ATTACK:enterprise:S0070 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--291b7fbf-5b5f-460a-8009-cadb383b3262

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b00f3f4-ddde-4874-8315-5a5c5d671a33

Secureworks Karagany July 2019

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bff8dad-2ef1-485c-8c0b-62a5ba4c384b

Cybereason Soft Cell June 2019

ATTACK:enterprise:T1027.012 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cea4c8c-4b22-4656-8e4e-fc52555f7b22

ATTACK:enterprise:T1027.017 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d3d9c31-1bd9-400e-a8b5-af9e4b53ebdb

ATTACK:enterprise:G0084 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e165a8a-928e-488e-ad16-afb77a94b460

Symantec Gallmaker Oct 2018

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e8b176a-b8a8-4bd0-8542-97ff009c673c

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f884873-308c-4bee-94bd-90bb2267fea7

PaloAlto NanoCore Feb 2016

ATTACK:enterprise:S0063 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--315aab88-9b01-4a70-8f8c-173a3f29e79c

FireEye Clandestine Wolf · Palo Alto CVE-2015-3113 July 2015

ATTACK:enterprise:S0627 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32035519-2c91-4fc2-a9c4-64c766510374

Securelist APT10 March 2021

ATTACK:enterprise:S0369 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--342502b6-c8fc-4ed5-ba10-209a824b78ed

CoinTicker 2019

ATTACK:enterprise:T1027.018 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37fc58a8-d37f-45cc-a1d7-8d4d8afa13bc

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--388ebc0a-6839-4b03-959c-766c1893cf64

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3979ca39-09a1-4a2b-a7d3-2eca5f1fb166

Morphisec Snip3 May 2021

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a86072e-4ca6-4b5d-bf31-b17c250f572e

CISA ComRAT Oct 2020 · ESET ComRAT May 2020

ATTACK:enterprise:S0355 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c92a16b-9f72-4f79-a656-e79c6c04e48f

Unit 42 Nokki Oct 2018

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40772ec1-2f25-425f-aad5-635f64ba8fd2

ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41118997-c45e-4123-be61-1b0c5d456256

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--426db174-3cc4-4f9c-ae34-6398a86ec3bd

Trustwave Pillowmint June 2020

ATTACK:enterprise:T1027.006 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4347eb2b-b33d-4e17-94f2-3701e18f0cab

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--451a9d37-4e16-4822-85db-821b1dd49ddc

SekoiaBourhis_DiceLoader_Feb2024

ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4527c528-8377-4349-ae5c-95c04cabd3d4

Cisco H1N1 Part 1

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--464e688d-b243-4619-a60b-1be6e2d6a827

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a339bd7-d356-44fb-9677-8f082af2fc11

FireEye NETWIRE March 2019

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a79cc78-872f-49f0-80c5-20f1b2dcd9f2

BlackBerry CostaRicto November 2020 · FireEye FiveHands April 2021 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:G0063 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ad9aa86-f489-4f0f-926f-f381221c3705

Securelist BlackOasis Oct 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d7e8d98-9894-4dfa-9013-af8d83e6faea

Fortinet Agent Tesla April 2018 · Malwarebytes Agent Tesla April 2020

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ff492bf-f91d-445d-a29e-6e60c67a05c1

S2 Grupo TrickBot June 2017

ATTACK:enterprise:S0259 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--549fdc30-5269-48ee-9dc8-60db8deb836a

ASERT InnaputRAT April 2018

ATTACK:enterprise:S0051 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--569815f7-4a3f-47f3-8903-0b0b2d409c3c

ESET Dukes October 2019

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56c927c5-f64e-4b31-9a14-7ce78fd1c8a1

Symantec Buckeye

ATTACK:enterprise:S0560 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--570df7f7-f2d5-4de9-ba74-4adfa99e980f

FireEye SUNBURST Backdoor December 2020 · Check Point Sunburst Teardrop December 2020 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S0167 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--573916d8-804d-4453-be37-e6b1865e87db

CopyKittens Nov 2015

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57c72f80-38bf-48b4-9f5d-eefef4025e34

Trend Micro DRBControl February 2020

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58d4910f-9d51-4961-84eb-9ef0ee2e8bc3

MDSec Brute Ratel August 2022 · Palo Alto Brute Ratel July 2022

ATTACK:enterprise:T1027.011 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59b7cc7f-469c-4dba-8ee0-4d458777abe7

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59df5f14-e570-417e-8184-e8e7c6c1ea75

Palo Alto Shamoon Nov 2016

ATTACK:enterprise:T1027.014 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d2d9aea-5ae2-45bd-9276-7af65e50c28f

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ef1c7d8-70bc-4634-b705-644f4d1db3b0

Symantec Elderwood Sept 2012 · Symantec Trojan.Hydraq Jan 2010

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--604fa5ae-0a32-45d7-9b9b-595fb43688b6

Cyberint Qakbot May 2021

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--624b57dc-3cae-45c7-8473-c5116df57697

Trellix Darkgate 2023

ATTACK:enterprise:S0696 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6610cf22-0a8c-4c30-bc6f-817b8cf29e61

NTT Security Flagpro new December 2021

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--662e03e7-a7bb-4c5b-ada4-e00275885fbb

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--662f14ec-90c6-48f7-98c6-ba028ca38621

McAfee Cuba April 2021

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b8d8354-0fa9-4a45-8df9-57709beace42

Checkpoint Dridex Jan 2021

ATTACK:enterprise:S0624 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c75071d-6997-4d41-88fa-bcd8d7b4cb76

Securelist APT10 March 2021

ATTACK:enterprise:S9007 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d5d5bcd-eb2e-47ae-9e8a-0d539b994144

Gen Digital Kimsuky HTTPTroy October 2025

ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f5973be-3c51-4bd1-b652-f12903caa3e2

Unit 42 NOKKI Sept 2018

ATTACK:enterprise:S0150 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70edcba2-e777-4ced-a52d-5dfc3965211c

FireEye POSHSPY April 2017

ATTACK:enterprise:T1027.010 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7139ac4a-7ece-47da-a5e5-0da99847d6fa

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--713fdffc-8955-43d6-b1bd-4515d3ca06a6

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71a121ba-b01c-418c-af8d-63df2cec70de

Talos Remcos Aug 2018 · Check Point Blind Eagle MAR 2025

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b17bab3-6c5a-4db2-969b-7724f71afc09

ESET Dukes October 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.